Google Chrome EUVD-2026-100652

Exploitation requires the victim to use Google Chrome prior to 155.0.8059.79 (desktop stable/extended-stable channels) and to navigate to attacker-controlled HTML content (UI:R) - this is the primary limiting factor, as the bug is not triggered passively without the user loading the crafted page. No authentication or special privileges are needed (PR:N), and default configurations are affected; no non-default feature flag is called out in the description. The most significant real-world limiter is that code execution is confined to the renderer sandbox (Scope: Unchanged) - meaningful host compromise additionally requires chaining a separate sandbox-escape vulnerability.

This is a genuine patching priority driven by the product rather than by confirmed exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a trivially satisfiable condition for a browser. However, multiple signals temper the raw score: no EPSS value was provided; there is no CISA KEV listing and no public POC; and CISA SSVC explicitly records Exploitation: none, Automatable: no. The description also constrains impact to 'arbitrary code execution inside the sandbox' (Scope: Unchanged), meaning a separate sandbox-escape chain would be needed for full host compromise. The CVSS C/I/H:H ratings and the 'sandbox' wording are therefore in tension - the high impact metrics reflect worst-case renderer compromise, not demonstrated host takeover. Net assessment: treat as high priority because Chrome is ubiquitous and UAF DOM bugs are historically weaponized quickly, but note that at the time of analysis exploitation is NOT confirmed and SSVC rates it as not automatable, suggesting it is not yet mass-exploited.

An attacker hosts a malicious web page (or injects malicious content into an ad/iframe on a legitimate site) that triggers a use-after-free in Chrome's DOM handling when a victim visits it with a vulnerable version. The freed-then-reused object lets the attacker corrupt renderer memory and execute code within the browser sandbox; given AC:L and UI:R, the only barrier is convincing the user to load the page. No public exploit code was identified at time of analysis, so weaponization would require independent development.